[v2] alpha: add support for SECCOMP and SECCOMP_FILTER

[PATCH v2 0/1] alpha: add support for SECCOMP and SECCOMP_FILTER

Posted by Magnus Lindholm 1 month, 1 week ago

This patch adds SECCOMP and SECCOMP_FILTER support to the Alpha
architecture.

The seccomp-bpf selftests exercise syscall tracing, restart, and signal
interaction paths that were previously untested on Alpha. To support
these, the ptrace/strace syscall path is updated to reliably distinguish
internal skip-dispatch from userspace invalid syscall numbers, ensuring
that syscall(-1) continues to return -ENOSYS with correct r0/a3
semantics.

Supporting seccomp also requires correct syscall restart handling when
ptrace and signal delivery are involved. The traced syscall entry path
now consistently tracks syscall state using r0, r1, and r2 while
preserving Alpha's a3-based error reporting ABI:

  - r1 holds the mutable "current" syscall number
  - r2 preserves the original syscall number for restart
  - r0 and r19 (a3) retain their traditional roles as return value and
    error indicator

This separation allows syscall restarts to be gated strictly on valid
ERESTART* return codes in the ptrace/strace paths and prevents
kernel-internal restart values from leaking into userspace.

Alpha also lacked support for PTRACE_GETREGSET(NT_PRSTATUS), causing
ptrace-based seccomp tests to fail with -EIO. Minimal GETREGSET and
SETREGSET support is added to export struct pt_regs directly.

With these changes applied, the seccomp-bpf and ptrace syscall selftests
(seccomp_bpf, extended for Alpha) pass reliably on Alpha systems.

---
Changes since v1:
 - Update features documentation for seccomp-filter/alpha
Link: https://lore.kernel.org/linux-alpha/20260205133049.526-1-linmag7@gmail.com/T/#t

Magnus Lindholm (1):
  alpha: add support for SECCOMP and SECCOMP_FILTER

 .../seccomp/seccomp-filter/arch-support.txt   |   2 +-
 arch/alpha/Kconfig                            |   2 +
 arch/alpha/include/asm/seccomp.h              |  13 ++
 arch/alpha/include/asm/syscall.h              |  90 ++++++++++++-
 arch/alpha/include/asm/thread_info.h          |  16 ++-
 arch/alpha/kernel/entry.S                     | 123 +++++++++++++++---
 arch/alpha/kernel/ptrace.c                    |  83 +++++++++++-
 7 files changed, 305 insertions(+), 24 deletions(-)
 create mode 100644 arch/alpha/include/asm/seccomp.h

-- 
2.52.0

Re: [PATCH v2 0/1] alpha: add support for SECCOMP and SECCOMP_FILTER

Posted by Michael Cree 1 month ago

On Fri, Feb 20, 2026 at 11:50:09AM +0100, Magnus Lindholm wrote:
> This patch adds SECCOMP and SECCOMP_FILTER support to the Alpha
> architecture.
> 
> The seccomp-bpf selftests exercise syscall tracing, restart, and signal
> interaction paths that were previously untested on Alpha. To support
> these, the ptrace/strace syscall path is updated to reliably distinguish
> internal skip-dispatch from userspace invalid syscall numbers, ensuring
> that syscall(-1) continues to return -ENOSYS with correct r0/a3
> semantics.
> 
> Supporting seccomp also requires correct syscall restart handling when
> ptrace and signal delivery are involved. The traced syscall entry path
> now consistently tracks syscall state using r0, r1, and r2 while
> preserving Alpha's a3-based error reporting ABI:
> 
>   - r1 holds the mutable "current" syscall number
>   - r2 preserves the original syscall number for restart
>   - r0 and r19 (a3) retain their traditional roles as return value and
>     error indicator
> 
> This separation allows syscall restarts to be gated strictly on valid
> ERESTART* return codes in the ptrace/strace paths and prevents
> kernel-internal restart values from leaking into userspace.
> 
> Alpha also lacked support for PTRACE_GETREGSET(NT_PRSTATUS), causing
> ptrace-based seccomp tests to fail with -EIO. Minimal GETREGSET and
> SETREGSET support is added to export struct pt_regs directly.
> 
> With these changes applied, the seccomp-bpf and ptrace syscall selftests
> (seccomp_bpf, extended for Alpha) pass reliably on Alpha systems.
> 
> ---
> Changes since v1:
>  - Update features documentation for seccomp-filter/alpha
> Link: https://lore.kernel.org/linux-alpha/20260205133049.526-1-linmag7@gmail.com/T/#t
> 
> Magnus Lindholm (1):
>   alpha: add support for SECCOMP and SECCOMP_FILTER
> 

Passes the seccomp-bpf selftests and the live tests of Adrian's
alpha-support branch of libseccomp on my ES45.

Tested-by: Michael Cree <mcree@orcon.net.nz>

Cheers,
Michael.